"If They Send a Friend Request... Could It Be That Person?" Replying Risks Personal Information Leakage

New Cyber Attack Inducing Malicious App Installation
"Be Careful If a Stranger Approaches You on KakaoTalk"

"Hello. I was organizing my KakaoTalk friends and saw you registered as a friend, so I'm contacting you. Excuse me, but who are you?"

Recently, a cyberattack has emerged where malicious applications (apps) are installed after sending such KakaoTalk messages, stealing entire contact lists. This attack targets unspecified many people and uses 'KakaoTalk,' known as the national messenger, requiring extra caution.

On the 21st, the Security Response Center (ESRC) of the security company ESTsecurity announced that cases of installing malicious apps on personal mobile phones through KakaoTalk targeting unspecified many have been continuously discovered.

The attack method is as follows. First, the attacker initiates conversation by claiming to be registered as a KakaoTalk friend or appearing in friend recommendations, arousing the recipient's curiosity. The attacker mainly impersonates Pilates or pole dance instructors to approach, but sometimes pretends to be an ordinary person.

If the user does not respond, the attack ends. However, if the user responds, the attacker naturally exchanges messages to build intimacy and then casually sends an installation file (.apk).

If the received app is installed, the contact information of acquaintances stored on the personal phone is entirely sent to the attacker and can be misused. The problem is that not only contacts but other information may also be stolen later.

ESRC stated, "So far, the identified apps only have contact collection functions, but various functions may be added in the future," and urged, "Do not reply to KakaoTalk messages from strangers, and especially never install '.apk' files received through channels other than Google Play."

Meanwhile, messenger phishing crimes using KakaoTalk are rapidly increasing. According to data on 'Voice Phishing Damage Status' submitted by the Financial Supervisory Service to Kang Min-guk, a member of the National Assembly's Political Affairs Committee from the People Power Party, the number of voice phishing damage cases from 2018 to 2022 was 227,126, with total damage amounting to 1.6645 trillion won.

Among these, the proportion of messenger phishing in total voice phishing has surged since 2020. The share of messenger phishing impersonating acquaintances in total voice phishing rose sharply from 34% (8,921 cases) in 2020 to 89% (25,534 cases) in 2022.

In particular, when examining the types of messengers used in messenger phishing, 23,602 cases involved 'KakaoTalk,' the 'national messenger.' This accounts for 95% of the total 24,808 reported cases by messenger type.